On: PHP Dark Arts: Sockets

I know I'll get flamed for this, but that's actually beautifully elegant.

and insecure. Correct version is:

  <?php echo htmlspecialchars($username); ?>

That's so incorrect I don't even know where to start.

I'd like to hear what's incorrect about it.

Do you think values should be escaped before output? Or that usernames don't include chars that need escaping in HTML? Or perhaps you'd add extra filtering to ensure that page cannot become ill-formed due to encoding error? Or perhaps it's incorrect to use PHP at all? ;)

whoa, dark art alert!!